last day (15 days later) » 

20:08
-1
Q: What is coming out a untagged trunk port?

ugnDoes all frames from all VLANs lose all taggings and all gets dumped to the end device? Even if the end device on this port is vlan-unaware, it can see all the frames. Background: obviously trunk port should always be tagged, but while I am looking at a network, this is exactly what I have found...

I'm not sure what you mean. Frames on trunks are tagged, except for the native VLAN. That is how the devices on each end of the trunk can separate frames into the correct VLANs.
ugn
ugn
thank you, added background to clarify.
Please expand on what you have. For example, a good network description or diagram, the network device models, and the network device configurations. You can refer to the Network Engineering Question Checklist for guidance, then edit your question.
ugn
ugn
I am pretty sure ports are tagged or untagged. for edge or for trunk
No, ports are not tagged, frames are tagged on trunks. A trunk interface will tag non-native VLAN frames.
ugn
ugn
20:08
@RonMaupin thank you for offering guidance, but this is really the question.
We simply do not have enough information to answer the question. Without the configurations, we simply cannot understand because the question is not clear as asked.
ugn
ugn
wait, I can clearly google "tagged vs untagged port", am I missing something?
Tags are inserted into frame headers. What do you think on an interface could be tagged? Look for 802.1Q.
ugn
ugn
Interface is not "tagged", the interface decides whether or not to tag/filterout the traffic?
Port(s) Type PVID PVID Format GVRP
1 Trunk 1 Tagged Disabled
2 Trunk 1 Tagged Disabled
3 Trunk 1 Tagged Disabled
4 Trunk 1 Tagged Disabled
5 Trunk 1 Tagged Disabled
6 Trunk 1 Tagged Disabled
7 Trunk 1 Tagged Disabled
8 Edge 4 Untagged Disabled
9 Trunk 1 Tagged Disabled
10 Trunk 1 Tagged Disabled
that's in my switch's configuration, how do you explain that?
It appears that all those interfaces are disabled, but the interfaces use GVRP to negotiate the trunk and allowed VLANs. A trunk tags frames for all the VLANs, except the native VLAN. That is the definition of a trunk.
ugn
ugn
20:16
the copy paste here didn't format correctly, please refer to the original post
Every one of your trunk interfaces tag the VLANs, and it appears that it even tags the PVID (native) VLAN, which would be a security feature.
ugn
ugn
I am leaning upon the correct answer to my question is: an untagged trunk port will output tagged vlan traffic, except for the native vlan
Trunk port is Cisco terminology and most widely accepted. However some vendors use trunk to refer to link aggregation, and instead they do use the terminolgy of tagged port for a port that carries multiple tagged VLANs.
You are mistaken in that the port is tagged. That is explaining that the PVID is tagged or not. That means frames for the primary VLAN for the interface (VLAN 1 by default) are either tagged or not tagged. It is frames that get tags, not the ports.
Now, typically on a trunk/tagged port the native VLAN, or in the case of this swtich the PVID, is the VLAN that is not tagged and all received untagged traffic is assigned to.
And this switch does use the Cisco terminology for Edge/Trunk.
ugn
ugn
20:24
Ok, probably I was using the wrong terminology then, but this "tagged" or "untagged" setting is clearly a per-port setting
As Ron notes, this is whether the port will tag or not tag the PVID VLAN when sending traffic out the port.
@ugn It is a per port setting for frames for the PVID sent from the port, not the port being tagged or untagged.
ugn
ugn
I see the logical difference.
So for this switch, a port with "Type" of "Edge" sends/receives only untagged traffic for one single VLAN.
A port with "Type" of "Trunk" can carry multiple VLANs.
ugn
ugn
so, probably a better wording is "tagging" or "untagging", a port is tagging or untagging the traffic is it carrying
20:28
The PVID in the case of a "Edge" port is the assigned VLAN, for a "Trunk" port is the native VLAN.
@ugn A trunk will tag all frames, except those for the native VLAN, except where the native VLAN traffic is also tagged, essentially having no native VLAN.
The "Tagged"/"Untagged" should only be configurable on a "Trunk" port and looks like it defaults to tagged.
ugn
ugn
thanks all.
but
Ron, there is always a native VLAN. As all frames that are received on the port must have someplace to go.
ugn
ugn
here is the question: a van unaware, listening to a trunk port that is PVID-untagged
20:30
And there is always the possibility of receiving untagged frames.
ugn
ugn
the vlan unaware can only see the untagged native vlan, but having no chance to hear anything else?
@ugn Probably, a host that does not understand VLAN tags will drop tagged frames as giants, but that certainly depends on the device.
A client device connected to trunk port will typically drop all tagged frames. So a client connected to a trunk port with untagged native VLAN will operate on the native VLAN.
ugn
ugn
thanks, if my indulge myself with just one more follow up:
But you really don't want to operate like that as you are sending unnecessary traffic to the end device and if it were configured to do so, it could receive all your tagged traffic as well.
ugn
ugn
20:33
if this client device is a computer, with Intel Advanced network, is configured to see all VLANs except for the native vlan. Can this computer see the native vlan?
rigth, but this is a faulty network that is, for some miracle, somehow functional
A client device will always see the traffic on the native VLAN, as it is untagged. The actual VLAN number it won't see, but those are really unimportant anyhow.
They are just a tag to keep traffic sorted when sending across a link carrying multiple VLANs.
If the native VLAN is tagged, then the client will also get the VLAN number. But they will likely drop all traffic unless configured to accept tagged frames.
ugn
ugn
the client is a computer that can see all VLANs EXCEPT for the native vlan, yet the native vlan's packets shows up in wireshark in one of the VLANS on the computer
because the native vlan's ip address belongs to one of the vlans
Say you have two devices on two ends of a trunk port. One device (D1) is configured to use VLAN 10 as the native VLAN. The second device (D2) is configured to use VLAN 20 as the native VLAN. Both are set to send native VLAN traffic as untagged. What happens?
ugn
ugn
Basically, for children's bed story: we have a dumb device on a trunk port communicating with a PLC that is on a VLAN... and the traffic between them is being flooded across the network...
to answer your question, they don't see each other.
I could be wrong, but native vlan is all 1 in this case.
actually, they can see each other
Yes they do. VLANs are just a logical construct.
Traffic send from D1 on VLAN 10 to D2 will be received by D2 as if it were VLAN 20 traffic.
And vice versa.
ugn
ugn
20:41
traffic is not tagged, so irrelavent. Now, what do you think of the "children bed story" I just mentioned, any hunches?
Would need a better understanding of the configuration and network layout.
ugn
ugn
yeah, I know. I can't give the network layout. But, it suggests to me that, that shouldn't really happen
You would need to start with what is the configuration on the port the "dumb device" is connected to and the configuration on the port the PLC is connected to?
ugn
ugn
PLC is on VLAN3 untagged port on a small switch.
Trunk/Edge?
ugn
ugn
20:44
dumb device on the same small switch Trunk, untagged
PLC is on VLAN3 untagged edge port on a small switch.
What is VLAN on the port to the dumb device?
ugn
ugn
small switch used tagged trunk port to a big switch tagged trunk port
trunk
The native or PVID VLAN?
ugn
ugn
1
Both devices are VLAN unaware?
ugn
ugn
20:46
on the big switch, a computer is listening to the trunk port, it can see VLAN 1, 2, 3
I can't tell, hopefully ONE of them IS vlan aware, otherwise this is really black magic
I am suspecting the dumb device is vlan aware, as the PLC is on an untagged edge port
Or there could be misconfiguration on either the small or big switch, or both.
Would also need to know more about the nature of the "flooded traffic" you mentioned.
ugn
ugn
the dumb device should be on an edge port obvious mistake on our part. but the question is really, HOw can the current faulty state be functional?
flood traffic: we know the devices are communicating with each other, modbus TCP traffics are getting thru. dumb's traffic can reach the PLC, but the PLC's traffic can't go directly to dumb, it is visibel to the computer on the big switch
Again, anyone would need to know more to answer that. Networks work pretty well according to standards. In the IT world, network traffic tends to be the most "logically" behaved thing to troubleshoot. If it isn't doing what you expect it is most likely misconfiguration somewhere.
ugn
ugn
yeah, but again, this is more about "what is this magic", instead of how to make this right
Barring some sort of bug, but those are far less common as the technology is fairly mature.
It isn't "magic", it is most likely misconfiguration. To know what is miconfigured, one would have to better understand the configuration.
Just because you may not understand what is taking place, doesn't mean it isn't behaving as networks are designed to operate.
ugn
ugn
20:53
The current logical conclusion is that... dumb device is vlan aware..
There may be other points where the configuration (or configuration on other devices) is problematic that are allowing the traffic you describe.
ugn
ugn
oh, what I meant is not "network behaving ilogical", it is more like what am I missing here
Doesn't mean the dumb device you are aware of is doing anything.
It may not be VLAN aware. There may be a third (or fourth, or fifth) piece you are not aware of at present.
ugn
ugn
on small switch's mac table: it doesn't even register the mac address on dumb device's mac, it shows empty
To understand, you need to look at the network as a whole system. Not just two isolated devices.
ugn
ugn
20:55
oh... another complication is that, there are 3 separate small switches with 3 separate dumb devices, and all those 3 dumb devices have the same MAC address. This is a purely switched network, no Router
it is a good "bed story"
So, you just added three devices using the same MAC. On the small switch's MAC table is there any entry for the MAC on any interface or VLAN?
ugn
ugn
the MAC table doesn't contain VLAN info... I can see the PLC's mac address on its supposed port
On the big switch, where is the MAC in the MAC table?
ugn
ugn
that... I didn't check... VERY VERY GOOD HINT!
Basically, what you are doing is providing information you believe is relevant, but there is likely more information that is necessary to understand the problem.
ugn
ugn
20:59
yes, I AM missing something
I often find that when people do packet captures with filtering enabled. They often inadvertently filter out the exact traffic they need to resolve the problem. It is better not assume you know what the problem is, capture it all and use display filters as this allows you go back and look at it differently as well.
Don't focus on what you believe the problem is, look at all the information and see where it takes you.
Limiting what you look at is a sure way to miss details that are important.
ugn
ugn
the mac address on those dumb devices are "0b:ad bad" something, basically it reads "bad bad"
but the big switch isn't aware of it. which is right, as the dumb device can somehow send its traffic to the PLC no problem
dumb to PLC traffic didn't get flooded to anywhere else, it is assumed to be confined within the small switch
the small switch in question is not a typical Cisco, it is an industrial
anyways, don't worry about solving this. I just thought this was a very "black magic", and good story.
thank you all.
I personally strongly dislike the whole network "black magic" thought process that often takes place. Networks tend to work as designed, but far too many people (even in IT circles) simply do not understand enough about how they operate.
So networks are often thought of as some "mysterious" black box that you put data into and sometimes get out at the right points. But they can be understood.
With the somewhat rare exception of running into a bug. But often you can determine that if you know how they operate enough to spot when they actually aren't operating as they should.

last day (15 days later) »